From e524b850f943d3f5e223d1f2b2f8d955a7215a1e Mon Sep 17 00:00:00 2001 From: Eric Wang <37554696+ericwang401@users.noreply.github.com> Date: Tue, 12 Dec 2023 16:33:49 -0600 Subject: [PATCH] add v1.1.0 again with new stuff --- CHANGELOG.md | 2 + src-rust/Cargo.lock | 121 ++++++++++++++++++++++++++++++++++---------- src-rust/Cargo.toml | 2 +- 3 files changed, 96 insertions(+), 29 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 23e6b92..03219aa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,8 @@ This project follows [Semantic Versioning](http://semver.org) guidelines. - Added support for XTerm.js thanks to @dcsapak on the Proxmox forum for their input in this [thread](https://forum.proxmox.com/threads/cannot-proxy-xterm-js-traffic.137831/). +- Bump webpki from 0.22.0 to 0.22.4 in #2 to patch CPU denial of service in certificate path building. +- Bump tokio-tungstenite from 0.18.0 to 0.21.0 to patch denial of service attack. ## v1.0.0 diff --git a/src-rust/Cargo.lock b/src-rust/Cargo.lock index e59470d..b3c288e 100644 --- a/src-rust/Cargo.lock +++ b/src-rust/Cargo.lock @@ -213,7 +213,7 @@ dependencies = [ "serde", "serde_json", "tokio", - "tokio-tungstenite 0.18.0", + "tokio-tungstenite 0.21.0", "tower-http", "tracing", "tracing-subscriber", @@ -555,9 +555,9 @@ checksum = "1788965e61b367cd03a62950836d5cd41560c3577d90e40e0819373194d1661c" dependencies = [ "http 0.2.9", "hyper 0.14.26", - "rustls", + "rustls 0.20.8", "tokio", - "tokio-rustls", + "tokio-rustls 0.23.4", ] [[package]] @@ -940,13 +940,13 @@ dependencies = [ "once_cell", "percent-encoding", "pin-project-lite", - "rustls", - "rustls-pemfile", + "rustls 0.20.8", + "rustls-pemfile 1.0.2", "serde", "serde_json", "serde_urlencoded", "tokio", - "tokio-rustls", + "tokio-rustls 0.23.4", "tower-service", "url", "wasm-bindgen", @@ -997,14 +997,29 @@ dependencies = [ "webpki", ] +[[package]] +name = "rustls" +version = "0.22.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fe6b63262c9fcac8659abfaa96cac103d28166d3ff3eaf8f412e19f3ae9e5a48" +dependencies = [ + "log", + "ring 0.17.3", + "rustls-pki-types", + "rustls-webpki", + "subtle", + "zeroize", +] + [[package]] name = "rustls-native-certs" -version = "0.6.2" +version = "0.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0167bac7a9f490495f3c33013e7722b53cb087ecbe082fb0c6387c96f634ea50" +checksum = "8f1fb85efa936c42c6d5fc28d2629bb51e4b2f4b8a5211e297d599cc5a093792" dependencies = [ "openssl-probe", - "rustls-pemfile", + "rustls-pemfile 2.0.0", + "rustls-pki-types", "schannel", "security-framework", ] @@ -1018,6 +1033,33 @@ dependencies = [ "base64 0.21.0", ] +[[package]] +name = "rustls-pemfile" +version = "2.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "35e4980fa29e4c4b212ffb3db068a564cbf560e51d3944b7c88bd8bf5bec64f4" +dependencies = [ + "base64 0.21.0", + "rustls-pki-types", +] + +[[package]] +name = "rustls-pki-types" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e7673e0aa20ee4937c6aacfc12bb8341cfbf054cdd21df6bec5fd0629fe9339b" + +[[package]] +name = "rustls-webpki" +version = "0.102.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "de2635c8bc2b88d367767c5de8ea1d8db9af3f6219eba28442242d9ab81d1b89" +dependencies = [ + "ring 0.17.3", + "rustls-pki-types", + "untrusted 0.9.0", +] + [[package]] name = "rustversion" version = "1.0.12" @@ -1218,6 +1260,12 @@ version = "0.9.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67" +[[package]] +name = "subtle" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc" + [[package]] name = "syn" version = "1.0.109" @@ -1354,25 +1402,20 @@ version = "0.23.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c43ee83903113e03984cb9e5cebe6c04a5116269e900e3ddba8f068a62adda59" dependencies = [ - "rustls", + "rustls 0.20.8", "tokio", "webpki", ] [[package]] -name = "tokio-tungstenite" -version = "0.18.0" +name = "tokio-rustls" +version = "0.25.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "54319c93411147bced34cb5609a80e0a8e44c5999c93903a81cd866630ec0bfd" +checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f" dependencies = [ - "futures-util", - "log", - "rustls", - "rustls-native-certs", + "rustls 0.22.1", + "rustls-pki-types", "tokio", - "tokio-rustls", - "tungstenite 0.18.0", - "webpki", ] [[package]] @@ -1387,6 +1430,22 @@ dependencies = [ "tungstenite 0.20.1", ] +[[package]] +name = "tokio-tungstenite" +version = "0.21.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c83b561d025642014097b66e6c1bb422783339e0909e4429cde4749d1990bc38" +dependencies = [ + "futures-util", + "log", + "rustls 0.22.1", + "rustls-native-certs", + "rustls-pki-types", + "tokio", + "tokio-rustls 0.25.0", + "tungstenite 0.21.0", +] + [[package]] name = "tokio-util" version = "0.7.7" @@ -1521,38 +1580,38 @@ checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed" [[package]] name = "tungstenite" -version = "0.18.0" +version = "0.20.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "30ee6ab729cd4cf0fd55218530c4522ed30b7b6081752839b68fcec8d0960788" +checksum = "9e3dac10fd62eaf6617d3a904ae222845979aec67c615d1c842b4002c7666fb9" dependencies = [ - "base64 0.13.1", "byteorder", "bytes", + "data-encoding", "http 0.2.9", "httparse", "log", "rand", - "rustls", "sha1", "thiserror", "url", "utf-8", - "webpki", ] [[package]] name = "tungstenite" -version = "0.20.1" +version = "0.21.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9e3dac10fd62eaf6617d3a904ae222845979aec67c615d1c842b4002c7666fb9" +checksum = "9ef1a641ea34f399a848dea702823bbecfb4c486f911735368f1f137cb8257e1" dependencies = [ "byteorder", "bytes", "data-encoding", - "http 0.2.9", + "http 1.0.0", "httparse", "log", "rand", + "rustls 0.22.1", + "rustls-pki-types", "sha1", "thiserror", "url", @@ -1930,3 +1989,9 @@ checksum = "80d0f4e272c85def139476380b12f9ac60926689dd2e01d4923222f40580869d" dependencies = [ "winapi", ] + +[[package]] +name = "zeroize" +version = "1.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d" diff --git a/src-rust/Cargo.toml b/src-rust/Cargo.toml index be8aace..5f61e97 100644 --- a/src-rust/Cargo.toml +++ b/src-rust/Cargo.toml @@ -15,7 +15,7 @@ serde = { version = "1.0", features = ["derive"] } serde_json = "1.0.96" tokio = { version = "1.27.0", features = ["full"] } tower-http = { version = "0.5.0", features = ["cors", "fs"] } -tokio-tungstenite = { version = "0.18.0", features = ["rustls-tls-native-roots"] } +tokio-tungstenite = { version = "0.21.0", features = ["rustls-tls-native-roots"] } futures-util = "0.3.28" dotenv = "0.15.0" reqwest = { version = "0.11.6", features = ["rustls-tls", "json"], default-features = false }